An unauthenticated SQL injection vulnerability in Campcodes Online Learning Management System 1.0 poses a critical risk of unauthorized database manipulation.

This is a SQL injection vulnerability (CWE-89) residing in the /admin/edit_department.php script. An unauthenticated attacker can exploit this flaw by supplying malicious input to the d parameter to execute arbitrary SQL commands.

The ability for an unauthenticated user to inject arbitrary SQL queries creates a significant threat to data confidentiality, integrity, and availability. With a CVSS score of 7.3, this vulnerability could allow attackers to bypass authentication, exfiltrate sensitive student or administrative records, or modify database contents. Such unauthorized access can lead to severe reputational damage and regulatory non-compliance regarding data privacy.

Immediate Action: As no official patch is currently identified, administrators should restrict network access to the /admin/edit_department.php endpoint or disable the affected module entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax patterns targeting the edit_department.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads directed at the vulnerable d parameter.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's write-up at https://github.com/luyisi-7/CVE/issues/3.

Given the availability of a public proof-of-concept and the lack of vendor-supplied patches, this vulnerability presents a clear and present danger to affected environments. Organizations must prioritize immediate mitigation via network segmentation or WAF rules to prevent exploitation until the vendor releases a secure version. Continuous monitoring of application logs is essential to detect any early signs of compromise.